CVE-2026-21569

{"id": "CVE-2026-21569", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21569", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T14:49:16.812896Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@atlassian.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.3}]}, "affected": [{"source": "security@atlassian.com", "affectedData": [{"vendor": "Atlassian", "product": "Crowd Data Center", "versions": [{"status": "affected", "version": "7.1.0 to 7.1.2"}, {"status": "unaffected", "version": "7.1.3"}]}]}], "published": "2026-01-28T01:16:14.187", "references": [{"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1712324819", "tags": ["Vendor Advisory"], "source": "security@atlassian.com"}, {"url": "https://jira.atlassian.com/browse/CWD-6453", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. \n\t\n\tThis XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. \n\t\n\tAtlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). \n\t\n\tThis vulnerability was reported via our Atlassian (Internal) program."}, {"lang": "es", "value": "Esta vulnerabilidad XXE (inyecci\u00f3n de entidad externa XML) de alta gravedad fue introducida en la versi\u00f3n 7.1.0 de Crowd Data Center y Server.\n\nEsta vulnerabilidad XXE (inyecci\u00f3n de entidad externa XML), con una puntuaci\u00f3n CVSS de 7.9, permite a un atacante autenticado acceder a contenido local y remoto, lo que tiene un alto impacto en la confidencialidad, bajo impacto en la integridad, alto impacto en la disponibilidad y no requiere interacci\u00f3n del usuario.\n\nAtlassian recomienda que los clientes de Crowd Data Center y Server actualicen a la \u00faltima versi\u00f3n; si no puede hacerlo, actualice su instancia a una de las versiones fijas compatibles especificadas:\n\n* Crowd Data Center y Server 7.1: Actualice a una versi\u00f3n mayor o igual a 7.1.3\n\nConsulte las notas de la versi\u00f3n (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). Puede descargar la \u00faltima versi\u00f3n de Crowd Data Center y Server desde el centro de descargas (https://www.atlassian.com/software/crowd/download-archive).\n\nEsta vulnerabilidad fue reportada a trav\u00e9s de nuestro programa Atlassian (Interno)."}], "lastModified": "2026-06-17T10:18:48.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D58C58C-051C-4A3E-BEC8-296F8086DDF5", "versionEndExcluding": "7.1.3", "versionStartIncluding": "7.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}